CVE-2020-15586: Cloudfoundry Cf-Deployment

Medium severity, CVSS 5.9. EPSS: 2.9% chance of exploitation in the next 30 days.

Go before 1.13.13 and 1.14.x before 1.14.5 has a data race in some net/http servers, as demonstrated by the httputil.ReverseProxy Handler, because it reads a request body and writes a response at the same time.

Affected products

• Cloudfoundry Cf-Deployment: before 13.7.0 (fixed in 13.7.0)
• Cloudfoundry Routing-Release: before 0.203.0 (fixed in 0.203.0)
• Debian Debian Linux: version 9.0 only; version 10.0 only
• Fedoraproject Fedora: version 31 only; version 32 only
• Golang Go: before 1.13.13 (fixed in 1.13.13); from 1.14.0, before 1.14.5 (fixed in 1.14.5)
• Opensuse Leap: version 15.1 only; version 15.2 only

Published 2020-07-17. Last modified 2026-06-17.